利用 Transport 查询指定 elaticsearch 数据

（1）maven 依赖

         <dependency>
            <groupId>org.elasticsearch</groupId>
            <artifactId>elasticsearch</artifactId>
            <version>${es.client.version}</version>
        </dependency>
        <dependency>
            <groupId>org.elasticsearch.client</groupId>
            <artifactId>transport</artifactId>
            <version>${es.client.version}</version>
        </dependency>

（2）使用场景

根据 服务名等，查询es的数据，还能使用 关键字

 （3）实现逻辑

package com.zlst.uimp.cloud.ccapi.module.log_search.service;

import com.zlst.uimp.cloud.ccapi.exception.UimpException;
import com.zlst.uimp.cloud.ccapi.module.log_search.vo.AppLogVo;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.elasticsearch.action.search.SearchRequestBuilder;
import org.elasticsearch.action.search.SearchResponse;
import org.elasticsearch.client.transport.TransportClient;
import org.elasticsearch.index.query.*;
import org.elasticsearch.search.SearchHit;
import org.elasticsearch.search.SearchHits;
import org.elasticsearch.search.sort.SortOrder;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import java.util.*;

/**
 * @Auther: yilei
 * @Date: 2020/3/31
 * @Description:
 */
@Service
@Slf4j
public class EsService {
    private final String TYPE = "_doc";
    private final String INDEX_NAME = "app-log-*";
    private final String TIMESTAMP = "@timestamp";
    private final Integer DEFAULT_PAGE_FROM = 0;
    private final Integer DEFAULT_PAGE_SIZE = 100;
    private final String KEYWORD = ".keyword";
    private final String CONTAINER_NAME = "kubernetes.container_name";
    private final String POD_NAME = "kubernetes.pod_name";
    private final String NAMESPACE_NAME = "kubernetes.namespace_name";
    private final String MESSAGE_ITEM = "message";

    @Autowired
    private TransportClient client;
    /**
     * 查询日志
     */
    public List searchLog(AppLogVo appLogVo) {
        SearchHit[] arrayHit = getSearchHits(appLogVo);
        List resultList = new ArrayList();
        if (null != arrayHit && arrayHit.length > 0) {
            for (int i = 0; i < arrayHit.length; i++) {
                // resultList.add(arrayHit[i].getSourceAsMap().get(MESSAGE_ITEM));
                resultList.add(arrayHit[i].getSourceAsMap().get(MESSAGE_ITEM));
            }
        }
        return resultList;
    }

    /**
     * 查询日志source
     */
    public SearchHit[] downloadLog(AppLogVo appLogVo) {
        SearchHit[] arrayHit = getSearchHits(appLogVo);
        return arrayHit;
    }

    private SearchHit[] getSearchHits(AppLogVo appLogVo) {
        BoolQueryBuilder boolQuery = QueryBuilders.boolQuery();
        // 查询条件
        if (null != appLogVo) {
            String serviceName = appLogVo.getServiceName();
            String instanceName = appLogVo.getInstanceName();
            String namespaceName = appLogVo.getNamespaceName();
            // 命名空间
            if (StringUtils.isNotEmpty(namespaceName)) {
                TermQueryBuilder namespace = QueryBuilders.termQuery(NAMESPACE_NAME + KEYWORD, namespaceName);
                boolQuery.must(namespace);
            }
            // 实例名
            if (StringUtils.isNotEmpty(instanceName)) {
                TermQueryBuilder podName = QueryBuilders.termQuery(POD_NAME + KEYWORD, instanceName);
                boolQuery.must(podName);
            }
            // 服务名
            if (StringUtils.isNotEmpty(namespaceName)) {
                WildcardQueryBuilder wildcardQueryBuilder = QueryBuilders.wildcardQuery(CONTAINER_NAME + KEYWORD, "*" + serviceName + "*");
                boolQuery.must(wildcardQueryBuilder);
            }
            // 关键词
            if (StringUtils.isNotEmpty(appLogVo.getKeyWord())) {
                boolQuery.must(QueryBuilders.matchQuery(MESSAGE_ITEM, appLogVo.getKeyWord()).operator(Operator.AND).minimumShouldMatch("75%"));
            }
            // 时间过滤
            if (null != appLogVo.getStart() && null != appLogVo.getEnd()) {
                boolQuery.filter(QueryBuilders.rangeQuery(TIMESTAMP).gte(appLogVo.getStart().getTime()).lte(appLogVo.getEnd().getTime()));
            }
            Integer from = appLogVo.getFrom() == null ? DEFAULT_PAGE_FROM : appLogVo.getFrom();
            Integer size = appLogVo.getSize() == null ? DEFAULT_PAGE_SIZE : appLogVo.getSize();
            System.out.println(boolQuery);
            try {
                //数据分页 SearchSourceBuilder对象的from方法设置起始位置，size方式设置显示的个数，可以实现数据分页。
                SearchRequestBuilder srb = client.prepareSearch(INDEX_NAME)
                        .setTypes(TYPE)
                        .setQuery(boolQuery)
                        .setFrom(from)
                        .setSize(size);
                SearchResponse searchResponse = null;
                if (appLogVo.getSort() == null || "0".equals(appLogVo.getSort())) {
                    searchResponse = srb.execute().actionGet();
                } else if ("1".equals(appLogVo.getSort())) {
                    searchResponse = srb.addSort(TIMESTAMP, SortOrder.ASC)
                            .execute().actionGet();
                } else if ("2".equals(appLogVo.getSort())) {
                    searchResponse = srb.addSort(TIMESTAMP, SortOrder.DESC)
                            .execute().actionGet();
                }
                SearchHits hits = searchResponse.getHits();
                return hits.getHits();
            } catch (Exception e) {
                client.close();
                throw new UimpException("查询es数据出错！");
            }
        }
        return null;
    }
}

 Vo：

package com.zlst.uimp.cloud.ccapi.module.log_search.vo;

import lombok.Data;

import java.util.Date;

@Data
public class AppLogVo {

    /**
     * 命名空间
     */
    private String namespaceName;

    /**
     * 服务名
     */
    private String serviceName;

    /**
     * 实例名
     */
    private String instanceName;

    /**
     * 日志所属时间区间
     */
    private Date start;
    private Date end;

    /**
     * 关键词
     */
    private String keyWord;


    /**
     * 数据返回的起始量
     * from，size为5，那么es将返回第8、9、10、11和12项结果
     */
    private Integer from;

    /**
     * 数据返回量
     */
    private Integer size;

    /**
     * 是否按时间降序
     * 0 或不传 代表 不排序，
     * 1 代表正序，
     * 2 代表降序
     */
    private String sort;

}

效果：